feat(doorman): badge listener + decoder TDD + deploy scaffolding [#355]

Modern successor of the 2018 Perl doorman (snapshot in legacy/):
bash+coreutils HID decoder, HA webhook dispatch, systemd unit.
Offline decoder suite green (9 tests); shellcheck zero-warning.

Umbrella #345. Work item: https://projects.knownelement.com/issues/355

.env.example

@@ -0,0 +1,23 @@
+# doorman config refs — copy to /etc/default/doorman on the reader host
+# (root:root 0600). Material values live only on the host; this file is
+# references/placeholders only, never real tokens.
+
+# HA webhook. The token is part of the URL path — treat as secret.
+DOORMAN_WEBHOOK_URL=https://<ha-host>/api/webhook/<token>
+
+# Reader label carried in webhook payloads (default: hostname)
+#DOORMAN_READER_NAME=pfvsvrpi
+
+# Input device glob (default: /dev/input/by-id/*-event-kbd). Pin it to the
+# reader's by-id name once hardware is confirmed (questions-v1 Q2).
+#DOORMAN_DEVICE=/dev/input/by-id/usb-13ba_Barcode_Reader-event-kbd
+
+# Optional relay/actuator path — pending questions-v1 Q1 (usbrelay vs e-lock).
+# Native HA webhooks always answer 200, so keep UNLOCK_ON_2XX false and let
+# HA drive the actuator; flip only if HA returns real accept/deny codes.
+#DOORMAN_UNLOCK_ON_2XX=false
+#DOORMAN_RELAY_DEV=3X9XI_1
+#DOORMAN_USBRELAY=/usr/bin/usbrelay
+#DOORMAN_HOLD=10
+#DOORMAN_HTTP_TIMEOUT=10
+#DOORMAN_DEBUG=false